Add reproducible Nix development environment

[mveril]

Summary

• add a reproducible Nix flake and locked dependencies
• document Nix, direnv, native Cargo, and supported-platform workflows
• align the Rust toolchain through rust-toolchain.toml
• validate the flake in GitHub Actions with nix flake check

Impact

Developers can use nix develop or direnv for a pinned environment while the existing native Cargo workflow remains available on Linux, macOS, and Windows.

Validation

• cargo fmt --all -- --check
• cargo test --all-targets --all-features (320 tests passed; one platform-dependent test ignored)
• nix flake check

The release-only contraction validation failure discovered by the Nix check was fixed separately on main in commit 5d9062e, keeping this PR scoped to developer tooling.